Exploitation Summary
EIP tracks 3 public exploits for CVE-2005-4427. PoCs published by A. Ramos.
AI-analyzed exploit summary The provided text describes SQL injection and XSS vulnerabilities in Cerberus Helpdesk, with an example URL demonstrating SQL injection via the 'ticket' parameter. No actual exploit code is present.
Description
Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) file_id parameter to attachment_send.php, (2) the $addy variable in email_parser.php, (3) $address variable in email_parser.php, (4) $a_address variable in structs.php, (5) kbid parameter to cer_KnowledgebaseHandler.class.php, (6) queues[] parameter to addresses_export.php, (7) $thread variable to display.php, (8) ticket parameter to display_ticket_thread.php.
Exploits (3)
The provided text describes SQL injection and XSS vulnerabilities in Cerberus Helpdesk, with an example URL demonstrating SQL injection via the 'ticket' parameter. No actual exploit code is present.
The provided text describes SQL injection and XSS vulnerabilities in Cerberus Helpdesk but does not include functional exploit code. It references a URL with a vulnerable parameter (`kbid`) but lacks a proof-of-concept payload.
This exploit demonstrates SQL injection and XSS vulnerabilities in Cerberus Helpdesk by manipulating the 'queues[]' parameter in a POST request to /cerberus-gui/addresses_export.php. The lack of input validation allows arbitrary SQL queries or script injection.